CVE-2014-2845

MEDIUM 5.9CVE-2014-2845 · Published 15/11/2017 · updated 17/06/2026

In short

CVE-2014-2845 is a MEDIUM (CVSS 5.9) vulnerability affecting cyberduck (cyberduck).
Chance of exploitation in the next 30 days (EPSS): 0.94%, higher than 61.0% of all vulnerabilities.
Fix: update to 4.4.4 or later.

Package	Affected versions	Patched versions
cyberduck cyberduck	`< 4.4.4`	`4.4.4`

Description

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority.

References

secunia.com/advisories/58426 · Issue Tracking
securityfocus.com/archive/1/532039/100/0/threaded · Exploit
cyberduck.io/changelog · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free